Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 10.0 CriticalCritical · CVSS 9+
Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow
- meshtastic firmware
- Code injection
- CWE-829
- CVSS 5.3 Medium
itsourcecode Courier Management System index.php cross site scripting
- itsourcecode Courier Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Online Examination System account.php cross site scripting
- code-projects Online Examination System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting
- Pluck CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
zevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injection
- zevorn rt-claw
- Other injection
- Code injection
- CVSS 5.1 Medium
SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Class and Exam Timetabling System CYS.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Class and Exam Timetabling System forexam.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
CartoDB carto-api-client filters.ts addFilter prototype pollution
- CartoDB carto-api-client
- Code injection
- Prototype pollution
- CVSS 5.3 Medium
RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution
- RobinHerbots Inputmask
- Code injection
- Prototype pollution
- CVSS 8.5 High
uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata
- scikit-hep uproot
- Code injection
- CVSS 8.7 High
VMware Avi Load Balancer Remote Code Execution Vulnerability
- VMware Avi Load Balancer
- Code injection
- CVSS 8.7 High
VMware Avi Load Balancer Remote Code Execution Vulnerability
- VMware Avi Load Balancer
- Code injection
- CVSS 8.7 High
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
- Code injection
>=2.0.0-alpha.1, <2.0.0-beta.3 · fixed in 2.0.0-beta.3
GHSA-c4gh-rv8h-q9vw · CVE-2026-53597 - CVSS 8.8 High
Parameter Injection Vulnerability in API Graph Execution Engine
- IBM Langflow OSS
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Remote Code Execution via Code Validation Endpoint
- IBM Langflow OSS
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Arbitrary Code Execution in Python Interpreter Component
- IBM Langflow OSS
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation
- IBM Langflow OSS
- Code injection
- CVSS 5.1 Medium
AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting
- AstrBot
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
- IBM Langflow OSS
- Code injection
- CVSS 7.8 High
IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control
- IBM Db2
- Code injection
- CVSS 5.3 Medium
sagold json-schema-library propertyDependencies.ts parsePropertyDependencies prototype pollution
- sagold json-schema-library
- Code injection
- Prototype pollution
- CVSS 9.1 CriticalCritical · CVSS 9+
An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component
- Command injection
- Code injection
- CVSS 8.6 High
ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
- Command injection
- Code injection
<26.7.2 · fixed in 26.7.2
GHSA-x9f9-r4m8-9xc2 · CVE-2026-67340 - CVSS 8.0 High
Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE
- Code injection
<1.16.5 · fixed in 1.16.5
GHSA-3v79-m2cg-89ww · CVE-2026-52833 - CVSS 9.9 CriticalCritical · CVSS 9+
Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping
- mwtcmi frogman
- Code injection
- CVSS 5.1 Medium
django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization
- Code injection
<3.4.0 · fixed in 3.4.0
GHSA-r3hx-x5rh-p9vv · CVE-2026-105315 - CVSS 8.8 High
MaaAssistantArknights: PR-title expression injection in release-preparation.yml
- MaaAssistantArknights
- Command injection
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
DataEase: RCE Vulnerability
- dataease
- Code injection
- CVSS 7.2 High
TDengine: UDF lead to RCE
- taosdata TDengine
- Code injection
- CVSS 8.4 High
PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters
- Code injection
<2.6.6 · fixed in 2.6.6
GHSA-qqmf-gpg7-g8gw · CVE-2026-58659 - CVSS 4.0, no score published
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
- Code injection
>=1.3.0, <2.28.4 · fixed in 2.28.4
GHSA-v84x-qvhg-f36r · CVE-2026-49273 - CVSS 8.8 High
ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix
- frappe erpnext
- Broken access control
- Code injection
- CVSS 8.4 High
Duplicate Advisory: PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
- Code injection
<=1.6.77 · no fixed version yet
GHSA-q359-rmv4-56fg - CVSS 7.8 High
Duplicate Advisory: PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
- Code injection
<=4.6.77 · no fixed version yet
GHSA-qpq9-hwx9-cwgc - CVSS 8.7 High
Grav Flex Objects - Server-Side Template Injection via Dynamic Titles
- grav
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling.
- Code injection
- CVSS 8.4 High
jadx: RCE Via Groovy Code Injection in Gradle Export
- skylot jadx
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Code injection
- CVSS 6.9 Medium
TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution
- Other injection
- Code injection
<=0.13.0 · no fixed version yet
GHSA-9hc2-hjx8-q6pv · CVE-2026-14722 - CVSS 7.2 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware
Code injection in SonicWall SMA1000
- SonicWall SMA1000
- Code injection
- CVSS 5.3 Medium
SourceCodester Class and Exam Timetabling System exam.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.5 Medium
Windows Admin Center Information Disclosure Vulnerability
- Microsoft Windows Admin Center
- Code injection
- Authentication bypass
- CVSS 5.3 Medium
tamagui config.ts updateConfig prototype pollution
- tamagui
- Code injection
- Prototype pollution
- CVSS 5.3 Medium
spencermountain compromise Public Root API extend.js nlp.extend prototype pollution
- spencermountain compromise
- Code injection
- Prototype pollution
- CVSS 5.3 Medium
kofrasa mingo Update API updateMany prototype pollution
- kofrasa mingo
- Code injection
- Prototype pollution
- CVSS 5.3 Medium
svgdotjs svg.js npm Package API EventTarget.on prototype pollution
- svgdotjs svg.js
- Code injection
- Prototype pollution
- CVSS 5.1 Medium
code-projects Online Job Portal DetailJob.php cross site scripting
- code-projects Online Job Portal
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/Update Project function
- Code injection
- CVSS 5.3 Medium
tanstack db Alias Path select.ts select prototype pollution
- tanstack db
- Code injection
- Prototype pollution
- CVSS 5.3 Medium
antv layout object.js setNestedValue prototype pollution
- antv layout
- Code injection
- Prototype pollution
- CVSS 5.3 Medium
SourceCodester Class and Exam Timetabling System subject.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval
- SQL injection
- Code injection
>=6, <8.0.79 || >=8.1.0a1, <9.0.22 || >=9.1.0, <9.1.10 · fixed in 8.0.79, 9.0.22, 9.1.10
GHSA-m4m7-4cw8-62j6 · CVE-2026-61667 - CVSS 9.5 CriticalCritical · CVSS 9+
Sandbox Escape in ServiceNow AI Platform
- ServiceNow AI Platform
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input
- Code injection
>=6, <8.0.79 || >=8.1.0a1, <9.0.22 || >=9.1.0, <9.1.10 · fixed in 8.0.79, 9.0.22, 9.1.10
GHSA-9jpv-c7p4-997x · CVE-2026-45579 - CVSS 4.8 Medium
Decidim: HTML content blocks allow stored script execution
- Code injection
<0.30.9 || >=0.31.0.rc1, <0.31.5 || >=0.32.0.rc1, <0.32.0 · fixed in 0.30.9, 0.31.5, 0.32.0
GHSA-533c-2vh9-4r86 · CVE-2026-45572 - CVSS 9.3 CriticalCritical · CVSS 9+
Remote code execution in Mura Software’s CMS
- Mura Software CMS
- Code injection
- CVSS 9.2 CriticalCritical · CVSS 9+
Remote Code Execution vulnerability in "Suspicious" application
- Thales CERT Suspicious
- Path traversal
- Code injection